Vulnerability Description
Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client_logo array, which is interpolated into an <img> src attribute without escaping.
Related Weaknesses (CWE)
References
- https://github.com/maalfer/pentestify/commit/a058a22b42c6311895622645265df79a602
- https://secur0.com/en/cna/cve-list/cve-2026-59238-stored-xss-in-pentestify-via-u
FAQ
What is CVE-2026-59238?
CVE-2026-59238 is a documented vulnerability. Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authe...
How severe is CVE-2026-59238?
CVSS scoring is not yet available for CVE-2026-59238. Check NVD for updates.
Is there a patch for CVE-2026-59238?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.